These fall under the protection level "signature|appop|pre23|preinstalled" which means that only same-signature apps (system signed basically), app operators, apps that target below API level 23 and presintalled apps can have these.